WEBVTT

0:00:03.820000 --> 0:00:06.180000
 Hello everyone and welcome.

0:00:06.180000 --> 0:00:10.620000
 In this video we're going to be taking
 a look at the key functions of

0:00:10.620000 --> 0:00:13.720000
 a security operations center or a SOC.

0:00:13.720000 --> 0:00:18.920000
 So in the previous video we got a formal
 introduction as to what a SOC

0:00:18.920000 --> 0:00:25.860000
 is and what it does or what it's responsible
 for, so on and so forth.

0:00:25.860000 --> 0:00:32.280000
 But now I want to turn your attention
 to the key functions of a SOC which

0:00:32.280000 --> 0:00:35.700000
 are different than these services.

0:00:35.700000 --> 0:00:42.600000
 So if you remember in the introductory
 video we talked about the SOC services,

0:00:42.600000 --> 0:00:49.040000
 that's different than the functions and
 it'll become apparent why or what

0:00:49.040000 --> 0:00:56.440000
 I'm referring to when parameters
 we progress.

0:00:56.440000 --> 0:00:58.520000
 So let's get started.

0:00:58.520000 --> 0:01:07.160000
 So to begin with when analyzing how a
 SOC functions or operates, breaking

0:01:07.160000 --> 0:01:13.740000
 down the complex workflow of security events
 into modular or atomic functions

0:01:13.740000 --> 0:01:19.420000
 provides clarity on inputs, outputs,
 goals and interactions with other

0:01:19.420000 --> 0:01:22.820000
 teams. So what does this mean?

0:01:22.820000 --> 0:01:30.860000
 Well the decomposition or the modularization
 of what exactly a SOC does,

0:01:30.860000 --> 0:01:36.400000
 I'm not talking about its services and
 how those services are categorized,

0:01:36.400000 --> 0:01:40.040000
 I'm referring to the day
-to-day operations.

0:01:40.040000 --> 0:01:47.360000
 The modularization of these functions
 enables organizations to assess

0:01:47.360000 --> 0:01:52.940000
 performance, optimize operations and
 ensure effective cyber defense.

0:01:52.940000 --> 0:01:55.460000
 So what are these functions?

0:01:55.460000 --> 0:02:00.200000
 Well you can see based on this particular
 diagram we're not talking about

0:02:00.200000 --> 0:02:05.580000
 the services or stuff like network security
 monitoring or anything like

0:02:05.580000 --> 0:02:14.200000
 this. What's highlighted in this particular
 slide is the set of core SOC

0:02:14.200000 --> 0:02:21.600000
 functions that really applies to any
 SOC or any group of people who call

0:02:21.600000 --> 0:02:29.540000
 themselves a SOC and they essentially
 comprise of sequential steps or

0:02:29.540000 --> 0:02:34.000000
 phases ranging from collection
 which I'll explain.

0:02:34.000000 --> 0:02:39.840000
 We have collection, detection, triage,
 investigation and then incident

0:02:39.840000 --> 0:02:43.980000
 response you have forensics because
 that's where it typically fits.

0:02:43.980000 --> 0:02:50.920000
 I also want you to pay attention to where
 threat intelligence is relevant

0:02:50.920000 --> 0:02:56.780000
 or the two functions that threat intelligence
 has the most, provides the

0:02:56.780000 --> 0:03:02.260000
 most value too which in this case
 is collection and detection.

0:03:02.260000 --> 0:03:06.580000
 Now if you're, again if you've worked
 in a SOC or you are an incident

0:03:06.580000 --> 0:03:13.520000
 responder then this is nothing new to
 you but we'll get into what threat

0:03:13.520000 --> 0:03:18.880000
 intelligence is if you're new to this
 concept or this practice but we'll

0:03:18.880000 --> 0:03:24.920000
 also explore why threat intelligence
 is relevant to those two functions

0:03:24.920000 --> 0:03:26.960000
 namely collection and detection.

0:03:26.960000 --> 0:03:31.440000
 So just want to give you an idea of
 what I'm referring to and again most

0:03:31.440000 --> 0:03:36.100000
 of you again if you have worked in a
 defensive role or as an analyst we'll

0:03:36.100000 --> 0:03:38.060000
 be familiar with these functions.

0:03:38.060000 --> 0:03:42.540000
 So collection, detection, triage, investigation,
 incident response okay

0:03:42.540000 --> 0:03:47.760000
 and you know based on these functions
 you can pretty much derive these

0:03:47.760000 --> 0:03:50.120000
 services that I mentioned
 in the previous video.

0:03:50.120000 --> 0:03:55.200000
 So when we talk about threat intelligence
 and threat hunting, threat hunting

0:03:55.200000 --> 0:03:59.680000
 really doesn't show up as a function
 here but you can see that it shows

0:03:59.680000 --> 0:04:07.280000
 up as a, I shouldn't say a core function
 but as a function nonetheless.

0:04:07.280000 --> 0:04:11.480000
 But you know I don't want to confuse
 you just yet let's proceed on.

0:04:11.480000 --> 0:04:15.020000
 This is typically what it looks like
 top down you know in a hierarchy

0:04:15.020000 --> 0:04:21.580000
 tree. So you know the image shown here
 to the right represents the fundamental

0:04:21.580000 --> 0:04:27.460000
 components or functions of operating
 a SOC categorized as core activities

0:04:27.460000 --> 0:04:31.740000
 or core functions that are essential to
 the responsibilities of the typical

0:04:31.740000 --> 0:04:38.160000
 SOC team. So from this you know you
 have, you know if you're to take a

0:04:38.160000 --> 0:04:43.780000
 look at the SOC team you have analysts
 that are assigned to detection,

0:04:43.780000 --> 0:04:48.320000
 you know they perform triage, investigation
 is then escalated let's say

0:04:48.320000 --> 0:04:57.140000
 to a tier two analyst and then incident
 response on and so forth.

0:04:57.140000 --> 0:05:06.240000
 The bottom idea sort of give you an
 overview or an understanding of you

0:05:06.240000 --> 0:05:11.880000
 know what services are the SOC provides
 or offers and where they fall

0:05:11.880000 --> 0:05:16.620000
 with you know with regards to functions
 and the reason for this categorization

0:05:16.620000 --> 0:05:23.060000
 or modularization should be fairly obvious
 you know you need to separate

0:05:23.060000 --> 0:05:29.080000
 the individuals working on let's say log
 collection or you know the analysts

0:05:29.080000 --> 0:05:32.720000
 who facilitate that and ensure that
 logs are being collected and shipped

0:05:32.720000 --> 0:05:37.800000
 you know to the C whatever and then
 have the detection side of things

0:05:37.800000 --> 0:05:41.920000
 you then have triage you
 know investigation etc.

0:05:41.920000 --> 0:05:47.540000
 So in the next set of slides this will
 be going through shortly we will

0:05:47.540000 --> 0:05:52.480000
 explore each of these functions in
 detail outlining A its objectives B

0:05:52.480000 --> 0:05:57.020000
 the methods for evaluating its effectiveness
 but also take a look at the

0:05:57.020000 --> 0:05:59.680000
 inputs and outputs because
 this is quite important.

0:05:59.680000 --> 0:06:04.160000
 So let's begin with data collection
 and aggregation.

0:06:04.160000 --> 0:06:09.240000
 So this is you know really the first
 function and you know we need to

0:06:09.240000 --> 0:06:10.380000
 start from the beginning.

0:06:10.380000 --> 0:06:12.740000
 So what is data collection
 and aggregation?

0:06:12.740000 --> 0:06:17.920000
 Well data collection and aggregation
 is the foundation of a SOC.

0:06:17.920000 --> 0:06:22.740000
 It involves gathering, normalizing and
 centralizing security related data

0:06:22.740000 --> 0:06:28.240000
 from various sources across an organization's
 entire IT infrastructure.

0:06:28.240000 --> 0:06:33.580000
 So this process ensures that SOC analysts
 and security tools like a SEAM

0:06:33.580000 --> 0:06:38.340000
 have the necessary visibility to detect,
 investigate and respond to security

0:06:38.340000 --> 0:06:40.440000
 incidents effectively.

0:06:40.440000 --> 0:06:42.820000
 All right so what are the inputs here?

0:06:42.820000 --> 0:06:45.540000
 Well these would be logs.

0:06:45.540000 --> 0:06:49.420000
 So those are obviously categories.

0:06:49.420000 --> 0:06:53.580000
 So we have security logs from firewalls,
 intrusion detection and prevention

0:06:53.580000 --> 0:06:59.260000
 systems, EDRs, the SEAM, cloud
 services and network devices.

0:06:59.260000 --> 0:07:03.540000
 You then have very very important
 use activity logs.

0:07:03.540000 --> 0:07:09.920000
 So these involve Windows event logs,
 Linux, Syslog, Active Directory logs.

0:07:09.920000 --> 0:07:13.160000
 You then have you know based on where
 the organization is using third

0:07:13.160000 --> 0:07:14.600000
-party services and database.

0:07:14.600000 --> 0:07:19.000000
 You have the application and database
 logs and then you also have another

0:07:19.000000 --> 0:07:22.940000
 input which is the threat
 intelligence feeds.

0:07:22.940000 --> 0:07:28.400000
 What that is referring to is the
 latest intelligence on IOC.

0:07:28.400000 --> 0:07:33.200000
 So indicators of compromise as well
 as IOA's indicators of attack.

0:07:33.200000 --> 0:07:37.480000
 The outputs are fairly simple
 for this particular function.

0:07:37.480000 --> 0:07:42.520000
 Centralized and structured logs
 coming from all systems.

0:07:42.520000 --> 0:07:47.400000
 Secondly, the logs should be enriched
 with threat intelligence.

0:07:47.400000 --> 0:07:50.700000
 So you start to contextualize them,
 you understand that okay this is a

0:07:50.700000 --> 0:07:58.400000
 this is a used threat intelligence to
 say is this potentially suspicious?

0:07:58.400000 --> 0:08:01.380000
 Is this particular event suspicious?

0:08:01.380000 --> 0:08:04.640000
 Let's say let's take the example
 of Windows event logs.

0:08:04.640000 --> 0:08:10.440000
 Using threat intelligence you can start
 to feed or enrich your logs and

0:08:10.440000 --> 0:08:15.820000
 sort of categorize or tag them based
 on generally threat intelligence

0:08:15.820000 --> 0:08:18.760000
 but also IOCs, IOA's.

0:08:18.760000 --> 0:08:25.120000
 So you can for example you can classify
 your tag you know Windows event

0:08:25.120000 --> 0:08:30.140000
 logs for you know partial execution
 as suspicious or you know whatever

0:08:30.140000 --> 0:08:34.720000
 but you know you use threat
 intelligence to do that.

0:08:34.720000 --> 0:08:37.640000
 And then of course the other output
 is real-time alerts for suspicious

0:08:37.640000 --> 0:08:41.460000
 activities. So once you've done the
 enriching you then need to create

0:08:41.460000 --> 0:08:44.340000
 alerts for specific types of activity.

0:08:44.340000 --> 0:08:53.740000
 So if you deem you know a particular set
 of if you deem execution of partial

0:08:53.740000 --> 0:08:58.860000
 as something to worry about then you
 you're able to set up alerts you

0:08:58.860000 --> 0:09:01.260000
 know for that particular activity.

0:09:01.260000 --> 0:09:05.340000
 Now the process and goals so what
 is the process what are the goals?

0:09:05.340000 --> 0:09:09.740000
 So you know firstly ensure complete visibility
 across IT assets by collecting

0:09:09.740000 --> 0:09:11.820000
 logs from all security relevant sources.

0:09:11.820000 --> 0:09:16.600000
 Be normalize and aggregate log data
 for efficient analysis that's very

0:09:16.600000 --> 0:09:20.620000
 important you need to have logs that
 you can actually analyze and read.

0:09:20.620000 --> 0:09:24.660000
 And then you have the third which is
 maintain data integrity for forensic

0:09:24.660000 --> 0:09:26.880000
 analysis and compliance.

0:09:26.880000 --> 0:09:30.440000
 Second you have detection
 and correlation.

0:09:30.440000 --> 0:09:34.220000
 So what is detection and correlation
 if it's not already obvious?

0:09:34.220000 --> 0:09:38.060000
 Well detection and correlation are core
 functions of a SOC that enables

0:09:38.060000 --> 0:09:42.460000
 security teams to identify or should
 say the SOC analysts to identify

0:09:42.460000 --> 0:09:48.720000
 analyze and connect disparate security
 events to detect malicious activities

0:09:48.720000 --> 0:09:53.080000
 before they escalate into full-blown
 security incidents or a full-blown

0:09:53.080000 --> 0:09:58.700000
 intrusion. Detection focuses on identifying
 suspicious or malicious activity

0:09:58.700000 --> 0:10:03.640000
 using security tools, log analysis
 and behavioral analytics.

0:10:03.640000 --> 0:10:08.620000
 And correlation involves linking related
 events across multiple data sources

0:10:08.620000 --> 0:10:14.360000
 to identify potential attack patterns,
 reduce false false positives that's

0:10:14.360000 --> 0:10:18.800000
 very very important and of course gain
 contextual insight into potential

0:10:18.800000 --> 0:10:20.900000
 security incidents.

0:10:20.900000 --> 0:10:25.420000
 So the inputs here should be again
 fairly obvious aggregated logs from

0:10:25.420000 --> 0:10:30.360000
 data collection sources, threat intelligence
 feeds so you know known IOCs

0:10:30.360000 --> 0:10:38.240000
 are intelligence on malicious IPs domains
 and then behavioral analytics

0:10:38.240000 --> 0:10:42.960000
 data so that's U-E-B-A so you know
 anomaly detection as well.

0:10:42.960000 --> 0:10:47.360000
 The outputs are security event alerts
 with correlation data so now you're

0:10:47.360000 --> 0:10:52.580000
 sort of enriching your logs in this
 particular case with the focus of

0:10:52.580000 --> 0:10:56.920000
 detecting malicious activity and you're
 doing so you know using correlation

0:10:56.920000 --> 0:11:08.260000
 data. The other output is a prioritized
 list of as it says here prioritized

0:11:08.260000 --> 0:11:12.140000
 list of potential threats and then
 of course another output from this

0:11:12.140000 --> 0:11:18.680000
 particular function is escalation of confirmed
 threats to triage and investigation.

0:11:18.680000 --> 0:11:23.280000
 So the bottom line is what comes into
 this particular function you know

0:11:23.280000 --> 0:11:27.480000
 namely detection and correlation are
 aggregated logs, threat intelligence

0:11:27.480000 --> 0:11:37.200000
 feeds behavioral analytics data, what
 comes out onto the list of potential

0:11:37.200000 --> 0:11:44.000000
 threats and of course escalation of confirmed
 threats to triage and investigation.

0:11:44.000000 --> 0:11:48.280000
 In terms of the process and goals of this
 function A you know detect suspicious

0:11:48.280000 --> 0:11:53.880000
 activities and anomalies in security
 policy violations B utilize you know

0:11:53.880000 --> 0:11:58.380000
 the SEAM and machine learning models
 to correlate security events and

0:11:58.380000 --> 0:12:03.060000
 identify you know potential patterns
 and C reduce false positives while

0:12:03.060000 --> 0:12:05.300000
 maintaining high fidelity alerts.

0:12:05.300000 --> 0:12:09.080000
 So bottom line is whatever's coming
 out from this particular function

0:12:09.080000 --> 0:12:14.980000
 or detection and correlation should
 you know return back to the outputs

0:12:14.980000 --> 0:12:19.960000
 should be properly correlated and you
 know it should be there should be

0:12:19.960000 --> 0:12:24.620000
 a prioritization based on you know various
 factors which we'll get into

0:12:24.620000 --> 0:12:31.860000
 and of course another potential output
 in the event that there is a an

0:12:31.860000 --> 0:12:38.900000
 incident or an alert would be escalation
 of confirmed threats to triage

0:12:38.900000 --> 0:12:43.620000
 and investigation which now brings us
 to the third function which is triage

0:12:43.620000 --> 0:12:45.080000
 which is very important.

0:12:45.080000 --> 0:12:48.400000
 So what is alert triage
 and prioritization?

0:12:48.400000 --> 0:12:52.880000
 So alert triage and prioritization is
 the process of analyzing categorizing

0:12:52.880000 --> 0:12:57.100000
 and ranking security alerts based on
 their severity impact and of course

0:12:57.100000 --> 0:12:59.940000
 likelihood of being an actual
 security incident.

0:12:59.940000 --> 0:13:04.320000
 Triage refers to sorting and assessing
 alerts to determine whether they

0:13:04.320000 --> 0:13:07.880000
 indicate a real security threat
 or a false positive.

0:13:07.880000 --> 0:13:12.420000
 Prioritization assigns an urgency level
 to alerts ensuring that the most

0:13:12.420000 --> 0:13:15.980000
 critical threats are addressed first
 while filtering out low risk and

0:13:15.980000 --> 0:13:17.640000
 irrelevant alerts.

0:13:17.640000 --> 0:13:22.920000
 The inputs are security event alerts from
 the SEAM you know IDS, IPS solutions

0:13:22.920000 --> 0:13:25.580000
 or even the EDR.

0:13:25.580000 --> 0:13:30.160000
 B another input is correlated alerts
 from threat detection systems.

0:13:30.160000 --> 0:13:34.060000
 So you know we talk about the previous
 outputs from detection and correlation

0:13:34.060000 --> 0:13:38.400000
 they're now coming into here and the
 third input is threat intelligence

0:13:38.400000 --> 0:13:40.820000
 and historical attack data.

0:13:40.820000 --> 0:13:43.380000
 What are the outputs categorized alerts?

0:13:43.380000 --> 0:13:47.900000
 So you now have alerts categorized
 as a low, medium, high critical.

0:13:47.900000 --> 0:13:51.640000
 The other output is escalation to tier
 two analysts for deep investigation

0:13:51.640000 --> 0:13:55.260000
 which is the next function investigation.


0:13:55.260000 --> 0:13:59.420000
 And don't worry I'll explain the various
 rules within a you know the various

0:13:59.420000 --> 0:14:04.520000
 rules and responsibilities within a SOC
 as we progress but you know generally

0:14:04.520000 --> 0:14:14.780000
 speaking that's tier two analysts who
 do implementation and reporting.

0:14:14.780000 --> 0:14:16.720000
 Now process and goals.

0:14:16.720000 --> 0:14:20.860000
 A categorize alerts based on severity
 likelihood and potential impact.

0:14:20.860000 --> 0:14:25.580000
 B very important reduce alert fatigue
 by filtering false positives and

0:14:25.580000 --> 0:14:29.900000
 benign events. C escalate confirmed
 threats for further investigation

0:14:29.900000 --> 0:14:31.640000
 and containment.

0:14:31.640000 --> 0:14:34.040000
 That brings us to investigation.

0:14:34.040000 --> 0:14:38.560000
 So the incident investigation this
 is a function just before what the

0:14:38.560000 --> 0:14:41.840000
 focus of this learning path is
 which is incident response.

0:14:41.840000 --> 0:14:46.940000
 So starting to get interesting and
 I hope you or you understand or you

0:14:46.940000 --> 0:14:51.300000
 can you can see the reason why I'm going
 through this with you or I wanted

0:14:51.300000 --> 0:14:56.300000
 to introduce the SOC to you formally
 and go through all of these you know

0:14:56.300000 --> 0:15:01.100000
 functions so that you can see where
 you you as an incident responder you

0:15:01.100000 --> 0:15:06.080000
 can see where you come into play you
 know in a SOC as a whole and more

0:15:06.080000 --> 0:15:10.420000
 importantly understand what your responsibilities
 are or what the the

0:15:10.420000 --> 0:15:14.480000
 outputs of the incident response function
 are as well as the inputs.

0:15:14.480000 --> 0:15:17.360000
 But what is incident investigation?

0:15:17.360000 --> 0:15:21.840000
 Well incident investigation and threat
 analysis you know sort of conflated

0:15:21.840000 --> 0:15:26.200000
 together are critical functions in a
 SOC responsible for determining the

0:15:26.200000 --> 0:15:29.920000
 full scope impact and cause
 of a security incident.

0:15:29.920000 --> 0:15:34.000000
 Incident investigation is the process
 of analyzing security alerts and

0:15:34.000000 --> 0:15:38.260000
 correlated events to determine whether
 a real security breach has occurred

0:15:38.260000 --> 0:15:43.940000
 or intrusion and how it unfolded threat
 analysis involves examining attackers

0:15:43.940000 --> 0:15:49.680000
 PTPs or tradecraft to understand how
 the attack was executed and how to

0:15:49.680000 --> 0:15:52.260000
 prevent similar incidents in the future.

0:15:52.260000 --> 0:15:54.500000
 What are the inputs here?

0:15:54.500000 --> 0:15:59.260000
 Escalated alerts from tier one SOC analysts,
 network and host logs, forensic

0:15:59.260000 --> 0:16:03.680000
 data as well, malware samples and reverse
 engineering reports if there

0:16:03.680000 --> 0:16:06.860000
 are any. What are the outputs here?

0:16:06.860000 --> 0:16:11.540000
 Number one, instant reports with root
 cause analysis be attack chain mapping

0:16:11.540000 --> 0:16:15.400000
 using the minor attack framework that's
 very common or commonplace I should

0:16:15.400000 --> 0:16:20.120000
 say and see recommendations for
 containment and mitigation.

0:16:20.120000 --> 0:16:22.560000
 So process and goals.

0:16:22.560000 --> 0:16:27.660000
 So a determine the full scope of an incident
 so entry point affected assets

0:16:27.660000 --> 0:16:32.860000
 impact and then be conduct log analysis
 endpoint investigation and of

0:16:32.860000 --> 0:16:34.220000
 course threat hunting.

0:16:34.220000 --> 0:16:40.380000
 C identify malware behaviors attack vectors
 and attack at TTPs so tactics

0:16:40.380000 --> 0:16:44.980000
 techniques and procedures so that's
 incident investigation.

0:16:44.980000 --> 0:16:47.860000
 And now we finally get
 to instant response.

0:16:47.860000 --> 0:16:51.440000
 All right, so given all of the functions
 that we've just gone through,

0:16:51.440000 --> 0:16:53.860000
 what is incident response?

0:16:53.860000 --> 0:16:57.120000
 It's really categorized
 broadly as handling.

0:16:57.120000 --> 0:17:02.760000
 But more granularly, it's what you'd call
 incident containment and response

0:17:02.760000 --> 0:17:07.040000
 are critical phases in the incident
 response life cycle which will get

0:17:07.040000 --> 0:17:11.160000
 to don't worry in this course as well
 as the next one which will actually

0:17:11.160000 --> 0:17:14.500000
 formally introduce you
 to incident response.

0:17:14.500000 --> 0:17:18.040000
 But the critical phases in the incident
 response life cycle where SOC

0:17:18.040000 --> 0:17:23.740000
 teams take immediate action, very important
 to stop an active attack,

0:17:23.740000 --> 0:17:29.020000
 be prevent further damage and see
 to restore normal operation.

0:17:29.020000 --> 0:17:33.940000
 So business continuity containment
 focuses on isolating the threat to

0:17:33.940000 --> 0:17:36.440000
 limit its to limit its spread and impact.


0:17:36.440000 --> 0:17:42.760000
 So what that means is preventing a potential
 intrusion from moving laterally

0:17:42.760000 --> 0:17:52.720000
 into other subnets of the network or
 just ensuring that let's take a basic

0:17:52.720000 --> 0:17:56.780000
 example that malware is not spreading
 or ransomware is not spreading.

0:17:56.780000 --> 0:18:02.600000
 Response which is sort of our focus involves
 removing the threat, remediating

0:18:02.600000 --> 0:18:06.900000
 vulnerabilities if any and implementing
 preventative security measures

0:18:06.900000 --> 0:18:09.320000
 to ensure the attacker does not return.

0:18:09.320000 --> 0:18:13.060000
 I shouldn't say cannot return but does
 not return through the same way

0:18:13.060000 --> 0:18:15.720000
 they got in. So what are the inputs here?


0:18:15.720000 --> 0:18:19.720000
 Well, the inputs coming from the previous
 function are investigated incidents

0:18:19.720000 --> 0:18:21.020000
 and confirmed threats.

0:18:21.020000 --> 0:18:26.140000
 So you don't want this very important
 because you don't want the output

0:18:26.140000 --> 0:18:30.980000
 if we take a look at incident investigation,
 we don't want false positives

0:18:30.980000 --> 0:18:36.920000
 or anything that's not been confirmed or
 anything that hasn't been investigated

0:18:36.920000 --> 0:18:44.760000
 fully to come into the incident response
 function or into this process.

0:18:44.760000 --> 0:18:47.620000
 So the bottom line is the inputs are
 typically investigated incidents

0:18:47.620000 --> 0:18:49.520000
 and confirmed threats.

0:18:49.520000 --> 0:18:54.180000
 So confirmed threats be forensic data,
 malware samples and affected systems

0:18:54.180000 --> 0:18:57.180000
 information. So information
 from the affected systems.

0:18:57.180000 --> 0:19:00.820000
 What are the outputs from the
 incident response function?

0:19:00.820000 --> 0:19:05.080000
 Well, a systems isolated from the network,
 the compromised systems that

0:19:05.080000 --> 0:19:11.120000
 is if they if a system or systems have
 been compromised, b threats have

0:19:11.120000 --> 0:19:18.300000
 been mitigated with remediation plans and
 c containment reports for stakeholders.

0:19:18.300000 --> 0:19:25.500000
 So in terms of the processes and goals,
 a contain active threat to prevent

0:19:25.500000 --> 0:19:31.320000
 further spread. So network segmentation,
 disabling accounts, b eradicate

0:19:31.320000 --> 0:19:35.140000
 threats by removing malicious files,
 revoking attack of assistance and

0:19:35.140000 --> 0:19:40.120000
 patching vulnerabilities, c implementing
 real time response actions via

0:19:40.120000 --> 0:19:44.000000
 saw, which is security orchestration,
 automation and response.

0:19:44.000000 --> 0:19:47.200000
 Don't worry, we'll also get into
 that if that's new to you.

0:19:47.200000 --> 0:19:51.620000
 But this is, you know, what incident response
 is all about incident handling

0:19:51.620000 --> 0:19:55.100000
 in general as a core function of a SOC.

0:19:55.100000 --> 0:19:56.500000
 This is the inputs.

0:19:56.500000 --> 0:19:58.960000
 So this is what you'd expect to get.

0:19:58.960000 --> 0:20:03.320000
 And the outputs are what you expected
 to deliver as part of your job role.

0:20:03.320000 --> 0:20:07.100000
 If you are an incident response analyst
 and, you know, in terms of the

0:20:07.100000 --> 0:20:10.300000
 process and goals, they have
 been outlined there.

0:20:10.300000 --> 0:20:13.560000
 And with that being said, that brings
 us to the end of this video.

0:20:13.560000 --> 0:20:16.200000
 And I will be seeing you
 in the next video.